feat(copilot): add share_file tool + surface file share state to the agent by TheodoreSpeaks · Pull Request #5656 · simstudioai/sim

TheodoreSpeaks · 2026-07-14T00:19:18Z

Summary

Add the sim-side share_file server tool handler: resolves a VFS path to the file, keeps the existing checks (org public-sharing policy, write/admin permission, ShareValidationError, and the FILE_SHARED/FILE_SHARE_DISABLED audit), then delegates to the shared upsertFileShare — same path the files UI uses
Register it in the server tool router (+ generated catalog entries)
Surface an ambient shared/shareAuthType flag on each file's metadata via one batched share lookup (no N+1), so the agent can see and grep what's shared — mirrors how workflows expose isDeployed

Pairs with

Copilot: simstudioai/mothership#353 (tool definition + agent routing). That must merge first — mship-tools:check regenerates the catalog from the copilot repo's tool-catalog-v1.json, so this PR's check stays red until fix(deps): bump the dependencies group in /apps/sim with 4 updates #353 lands.

Type of Change

New feature

Testing

tsc --noEmit 0 errors; bun run lint:check and check:api-validation:strict pass; biome clean

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Companion: simstudioai/mothership#353

vercel · 2026-07-14T00:19:25Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 14, 2026 4:25am

cursor · 2026-07-14T00:19:29Z

PR Summary

Medium Risk
Copilot can create public file links subject to existing policy gates; the auth-type validation fix closes a policy bypass on bare re-enable, but sharing remains a sensitive access-control surface.

Overview
Adds a share_file copilot server tool so the agent can create/update or deactivate public links for workspace files by VFS path, using the same upsertFileShare flow as the files UI (write access, org public-sharing policy, audit events).

Policy fix (API + tool): When re-enabling a share without passing authType, validation now uses the effective auth mode (requested authType ?? existing share's authType ?? public) so a previously password/email/SSO link cannot be turned back on under a default public check after the org disallows that mode.

Agent visibility: Workspace VFS file meta.json now includes shared, shareAuthType, and shareUrl via a batched getSharesForResources lookup (fail-soft on errors). Generated tool catalog/schemas register share_file and wire it in the server tool router.

^{Reviewed by Cursor Bugbot for commit 9e1e71a. Bugbot is set up for automated code reviews on this repo. Configure here.}

TheodoreSpeaks · 2026-07-14T00:19:32Z

@greptile review

greptile-apps · 2026-07-14T00:21:47Z

Greptile Summary

This PR adds file sharing support for the Copilot agent. The main changes are:

New share_file server tool for sharing and unsharing workspace files.
Router and generated catalog entries for the new tool.
Shared-file metadata fields in the Copilot VFS.
Policy validation updates for re-enabling existing file shares.

Confidence Score: 5/5

This looks safe to merge.

No blocking issues found in the changed code.
The share re-enable path now validates the stored auth mode before persisting.
Share metadata lookup now fails soft instead of hiding the file tree.

Important Files Changed

Filename	Overview
apps/sim/lib/copilot/tools/server/files/share-file.ts	Adds the Copilot file-sharing tool with workspace write access, file resolution, share policy validation, shared upsert behavior, and audit logging.
apps/sim/app/api/workspaces/[id]/files/[fileId]/share/route.ts	Updates file-share validation to check the auth type that will be persisted when a share is enabled.
apps/sim/lib/copilot/vfs/workspace-vfs.ts	Adds batched share-state loading for file metadata and falls back cleanly when share metadata cannot be loaded.
apps/sim/lib/copilot/vfs/serializers.ts	Adds shared-file metadata fields to serialized file records.
apps/sim/lib/copilot/tools/server/router.ts	Registers `share_file` as a write-capable server tool.

_{Reviews (5): Last reviewed commit: "feat(copilot): add share_file tool handl..." | Re-trigger Greptile}

greptile-apps · 2026-07-14T00:21:56Z

Greptile Summary

This PR adds Copilot support for sharing workspace files. The main changes are:

New share_file server tool and router registration.
Generated tool catalog and runtime schema entries.
File VFS metadata now includes shared and shareAuthType.
Workspace file materialization now batches share-state lookups.

Confidence Score: 4/5

The share tool and VFS enrichment paths need fixes before merging.

Re-sharing without authType can reactivate an old share mode after validating a different one.
A share-state lookup failure can make the Copilot VFS return no files.
The generated catalog and router wiring otherwise match the new tool shape.

apps/sim/lib/copilot/tools/server/files/share-file.ts; apps/sim/lib/copilot/vfs/workspace-vfs.ts

Security Review

The new share tool can reactivate an existing non-public share mode after validating the request as public when authType is omitted.

Important Files Changed

Filename	Overview
apps/sim/lib/copilot/tools/server/files/share-file.ts	Adds the new share/unshare server tool; the omitted-auth path can validate a different share mode than the one that is reactivated.
apps/sim/lib/copilot/tools/server/router.ts	Registers `share_file` as a write-capable server tool.
apps/sim/lib/copilot/generated/tool-catalog-v1.ts	Adds the generated catalog entry for the new Copilot file-sharing tool.
apps/sim/lib/copilot/generated/tool-schemas-v1.ts	Adds the generated runtime parameter and result schema for `share_file`.
apps/sim/lib/copilot/vfs/serializers.ts	Adds optional share-state fields to serialized file metadata.
apps/sim/lib/copilot/vfs/workspace-vfs.ts	Adds batched share-state enrichment during file materialization; the new lookup can currently hide all files if it fails.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
  participant Agent as Copilot agent
  participant Router as Server tool router
  participant Tool as share_file tool
  participant Policy as Share policy check
  participant Shares as Share manager
  participant VFS as Workspace VFS

  Agent->>Router: share_file(path, action, authType?)
  Router->>Tool: execute with workspace context
  Tool->>Policy: validate requested share mode
  Tool->>Shares: create, update, or disable file share
  Shares-->>Tool: share state
  Tool-->>Agent: success message and share data

  VFS->>Shares: batch lookup file share states
  Shares-->>VFS: share map by file id
  VFS-->>Agent: file metadata with shared/shareAuthType

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
  participant Agent as Copilot agent
  participant Router as Server tool router
  participant Tool as share_file tool
  participant Policy as Share policy check
  participant Shares as Share manager
  participant VFS as Workspace VFS

  Agent->>Router: share_file(path, action, authType?)
  Router->>Tool: execute with workspace context
  Tool->>Policy: validate requested share mode
  Tool->>Shares: create, update, or disable file share
  Shares-->>Tool: share state
  Tool-->>Agent: success message and share data

  VFS->>Shares: batch lookup file share states
  Shares-->>VFS: share map by file id
  VFS-->>Agent: file metadata with shared/shareAuthType

_{Reviews (1): Last reviewed commit: "feat(copilot): add share_file tool handl..." | Re-trigger Greptile}

github-actions · 2026-07-14T00:27:37Z

⚠️ Cross-repo companion check

One or more companion PRs aren't merged into staging yet. Merging this without them will leave copilot and sim out of sync — merge them in lockstep.

❌ simstudioai/mothership#353 — OPEN, not merged (targets staging) — feat(file-agent): add share_file tool and route file-sharing to the file agent

TheodoreSpeaks · 2026-07-14T00:44:10Z

@greptile review

Addressed the auth-type validation finding: share_file (and the share PUT route) now resolve the effective authType (authType ?? existingShare.authType ?? 'public') before calling validatePublicFileSharing, so a bare re-enable can no longer reactivate a now-disallowed password/email/sso share.

greptile-apps · 2026-07-14T00:46:25Z

+      const shareByFileId = await getSharesForResources(
+        'file',
+        files.map((file) => file.id)
+      )


Share lookup hides files

When getSharesForResources throws during a transient DB failure, this await is caught by the method-level catch, which returns an empty file list. The agent then sees no workspace files even though listWorkspaceFiles already succeeded. Since this share state is only metadata enrichment, the lookup should fall back to an empty share map so file metadata still materializes with shared: false.

TheodoreSpeaks · 2026-07-14T01:13:45Z

@greptile review

Addressed both findings:

Auth-type bypass (P1) — share_file and the share PUT route now validate the effective authType (authType ?? existingShare.authType ?? 'public') before validatePublicFileSharing, so a bare re-enable can't reactivate a now-disallowed password/email/sso share.
Share lookup hides files (P1) — the getSharesForResources enrichment in workspace-vfs.ts now fails soft (its own try/catch → empty share map), so a transient share-query failure degrades to shared: false instead of dropping the whole file tree.

…te to the agent Implement the sim-side share_file server tool (resolves VFS path to file, keeps the existing org-policy + permission + audit checks, delegates to upsertFileShare). Register it in the tool router and generated catalog. Stamp an ambient 'shared'/'shareAuthType' flag onto file metadata via one batched share lookup, mirroring how workflows expose 'isDeployed'. Validate the EFFECTIVE auth type when re-enabling a share: upsertFileShare preserves an existing share's authType when none is passed, so validate the stored mode (not 'public') or a re-share could reactivate a now-disallowed password/email/sso share. Same fix applied to the share PUT route.

TheodoreSpeaks · 2026-07-14T04:25:44Z

@greptile review

Added shareUrl to file metadata (alongside shared/shareAuthType) so the agent can read an already-shared file's public link directly, without re-sharing. Sourced from the same batched getSharesForResources lookup — no extra query; only present when shared is true.

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9e1e71a. Configure here.}

cursor · 2026-07-14T04:27:26Z

+        authType,
+        password,
+        allowedEmails,
+      })


Unshare clears stored auth type

High Severity

share_file still forwards authType into upsertFileShare on unshare, even though the catalog says it is ignored. upsertFileShare always persists authType, so an unshare that includes the schema default public overwrites a stored password/email/sso mode. A later bare re-enable then restores a public link instead of the prior protection.

^{Reviewed by Cursor Bugbot for commit 9e1e71a. Configure here.}

cursor Bot reviewed Jul 14, 2026

View reviewed changes

Comment thread apps/sim/lib/copilot/tools/server/files/share-file.ts

greptile-apps Bot reviewed Jul 14, 2026

View reviewed changes

Comment thread apps/sim/lib/copilot/tools/server/files/share-file.ts Outdated

Comment thread apps/sim/lib/copilot/vfs/workspace-vfs.ts Outdated

greptile-apps Bot reviewed Jul 14, 2026

View reviewed changes

Comment thread apps/sim/lib/copilot/tools/server/files/share-file.ts Outdated

Comment thread apps/sim/lib/copilot/vfs/workspace-vfs.ts Outdated

github-actions Bot added the requires-mothership-merge Has a companion PR on the mothership/copilot side — merge in lockstep label Jul 14, 2026

TheodoreSpeaks force-pushed the feat/share-file-mothership branch from 472a037 to 1673192 Compare July 14, 2026 00:43

vercel Bot temporarily deployed to Preview July 14, 2026 00:43 Inactive

greptile-apps Bot reviewed Jul 14, 2026

View reviewed changes

TheodoreSpeaks force-pushed the feat/share-file-mothership branch from 1673192 to 1d76a7e Compare July 14, 2026 01:13

vercel Bot temporarily deployed to Preview July 14, 2026 01:13 Inactive

TheodoreSpeaks force-pushed the feat/share-file-mothership branch from 1d76a7e to 9e1e71a Compare July 14, 2026 04:25

vercel Bot temporarily deployed to Preview July 14, 2026 04:25 Inactive

cursor Bot reviewed Jul 14, 2026

View reviewed changes

Uh oh!

Conversation

TheodoreSpeaks commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Pairs with

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

TheodoreSpeaks commented Jul 14, 2026

Uh oh!

Uh oh!

greptile-apps Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Jul 14, 2026

Greptile Summary

Confidence Score: 4/5

Security Review

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 14, 2026

⚠️ Cross-repo companion check

Uh oh!

TheodoreSpeaks commented Jul 14, 2026

Uh oh!

greptile-apps Bot Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

TheodoreSpeaks commented Jul 14, 2026

Uh oh!

TheodoreSpeaks commented Jul 14, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jul 14, 2026

Choose a reason for hiding this comment

Unshare clears stored auth type

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

TheodoreSpeaks commented Jul 14, 2026 •

edited

Loading

vercel Bot commented Jul 14, 2026 •

edited

Loading

cursor Bot commented Jul 14, 2026 •

edited

Loading

greptile-apps Bot commented Jul 14, 2026 •

edited

Loading